Data Breach, Vulnerability Data on Track to Set New Records in 2017

Enterprise security executives looking for metrics to justify their budgets to top management should have plenty of material to choose from for the rest of year.

Two reports from Risk Based Security this week show that numbers related to data breaches and software vulnerabilities look set to break new records in 2017, if first quarter trends are any indication.

Risk Based Security's analysis of Q1 data showed there were a total of 1,254 publicly reported data breaches worldwide, which together exposed a mind-boggling 3.4 billion records containing sensitive data.

Two breaches alone accounted for over 2.5 billion of those breached records. One involved River City Media and exposed 1.34 billion email addresses while the other at Chinese Internet Service Provider NetEase Inc. exposed nearly 1.3 billion email addresses and passwords that were later sold on the Dark Web.

On the vulnerability front, Risk Based Security's VulnDB database published a total of 4,837 vulnerabilities in the first quarter of 2017. That number was 29.2% higher than the number of discovered vulnerabilities in the same quarter in 2016 and some 2,274 more than the vulnerabilities in the widely used National Vulnerability Database (NVD).

More than 35% of the flaws already had publicly available exploits or there was enough information about them to make the flaws trivially exploitable, according to Risk Based Security. Over 50% of the disclosed software flaws were remotely exploitable while 18% had a severity rating of 9 or above on an ascending scale of 1 to 10.

The numbers are sobering and suggest that 2017 is well on its way to becoming the worst year on record for data breaches and software vulnerabilities. For all of 2016 for instance, data breaches exposed 4.2 billion records compared to the 3.4 billion in this year's first quarter alone.

The number of extremely large datasets that have been exposed so far this year or offered for sale in particular is surprising, says Inga Goddijn, executive vice president at Risk Based Security.

"After last year's disclosure at Yahoo, we thought it would be a long time before we saw another breach exposing over 1 billion records," she says. Surprisingly, there were two events in Q1 that exposed over one billion records.

The same widespread phishing and business email compromise activity that drove breach numbers in 2016 is fuelling the trend this year as well, according to Risk Based Security. Many of the phishing campaigns have targeted data in W-2 forms for the purposes of carrying on tax fraud.

But as massive as the data breach numbers are, the overall severity of data breaches has not gotten significantly worse.

"While there were a number of surprisingly large breaches, the overall severity of breach events remains steady," Goddijn says. Risk Based Security assigns severity scores based on the number of records that were exposed in a breach, the type of data that was involved, the breached industry, and other factors.

"Approximately 45% of reported breaches impacted somewhere between one and 10,000 records and the majority of breaches score below a 6 on our severity scale of 0.01 to 10," in terms of type of data exposure and impact. "It is encouraging to see severity scores staying relatively steady, indicating overall breach severity is not increasing," Goodign says.

Significantly, nearly 18% of the reported data breaches in the first quarter of 2017 had unknown origins. An unknown breach, says Goodijn, is one where the organization responsible for a data leak cannot be identified at the time of the compromise. "This tends to happen when data is leaked and the persons doing the leaking does not identify the data source or when there is a business relationship between the party responsible for the compromise and the party disclosing the breach," she says.

Jake Kouns, the chief information security office and chief operating officer at Risk Based Security, says a lot of the vulnerabilities discovered in products stem from a lack of mature software development practices at many organizations.

"Of all the vulnerabilities disclosed in Q1 2017, 68.1% are due to insufficient or improper input validation," Kouns says. "While a lot of vulnerabilities fall under this umbrella, including cross-site scripting, SQL injection, shell command injection, and buffer overflows, it underlines that vendors still struggle to carefully validate untrusted input," he says.

Web-related flaws accounted for nearly 60% of publicly disclosed vulnerabilities in Q1 2017. Of this, 30% were SQL injection errors.

Risk Based Security's vulnerability count includes flaws in the National Vulnerability Database that have an assigned CVE number attached to them as well as vulnerabilities for which no CVEs are yet available. Contrary to popular perception, the lack of a CVE number does not automatically mean a vulnerability is not serious or effects only obscure products, Risk Based Security said.

Overall, products from major vendors accounted for 31.1% of the vulnerabilities reported in Q1 2017, Kouns says.

Topping the list of companies with the most publicly reported vulnerabilities in its products was Oracle with 369 security vulnerabilities across its software portfolio. Google, which often makes a big deal about flaws in software from other vendors, came in second with 302 reported security vulnerabilities, while Microsoft took third spot with 204.

Adobe topped the list from a vulnerability severity standpoint. The 100 vulnerabilities that were discovered in its products in the first quarter had an average severity rating of 8.84 compared to 6.05 for Oracle's vulnerabilities and 6.62 for Microsoft's software flaws. Google ranked second with security vulnerabilities in its products, having an average vulnerability severity score of 7.1.